Generating a Self-Signed Certificate

Run the Key Tool utility (imqkeytool) to generate a self-signed certificate for the broker. (On UNIX® systems, you may need to run the utility as the superuser (root) in order to have permission to create the key store.) The same certificate can be used for the ssljms, ssladmin, or cluster connection service.

Enter the following at the command prompt:

imqkeytool -broker

The Key Tool utility prompts you for a key store password:

   Generating keystore for the broker ...
   Enter keystore password:

Next, the utility prompts you for information identifying the broker to which this certificate belongs. The information you supply will make up an X.500 distinguished name. Table 7–5 shows the prompts and the values to be provided for each. Values are case-insensitive and can include spaces.

Table 7–5 Distinguished Name Information Required for a Self-Signed Certificate

Prompt	X.500 Attribute	Description	Example
What is your first and last name?	commonName (CN)	Fully qualified name of server running the broker	mqserver.sun.com
What is the name of your organizational unit?	organizationalUnit (OU)	Name of department or division	purchasing
What is the name of your organization?	organizationName (ON)	Name of larger organization, such as a company or government entity	My Company, Inc.
What is the name of your city or locality?	localityName (L)	Name of city or locality	San Francisco
What is the name of your state or province?	stateName (ST)	Full (unabbreviated) name of state or province	California
What is the two-letter country code for this unit?	country (C)	Standard two-letter country code	US

When you have entered the information, the Key Tool utility displays it for confirmation. For example:

   Is CN=mqserver.sun.com, OU=purchasing, ON=My Company, Inc.,
   L=San Francisco, ST=California, C=US correct?

To accept the current values and proceed, enter yes; to reenter values, accept the default or enter no. After you confirm, the utility pauses while it generates a key pair.

Next, the utility asks for a password to lock the key pair (key password). Press Return in response to this prompt to use the same password as the key password and key store password.

---

Note –

Remember the password you specify. You must provide this password when you start the broker, to allow the broker to open the key store. You can store the key store password in a password file (see Password Files).

---

The Key Tool utility generates a self-signed certificate and places it in Message Queue’s key store. The key store is located in a directory that depends upon the operating system, as shown in Appendix A, Platform-Specific Locations of Message Queue^TM Data.

The following are the configurable properties for the Message Queue key store for SSL-based connection services:

• imq.keystore.file.dirpath: The path to the directory containing the key store file. For the default value, see Appendix A, Platform-Specific Locations of Message Queue^TM Data.

• imq.keystore.file.name: The name of the key store file.

• imq.keystore.password: The key store password.

In some circumstances, you may need to regenerate a key pair in order to solve certain problems: for example, if you forget the key store password or if the SSL-based service fails to initialize when you start a broker and you get the exception

java.security.UnrecoverableKeyException: Cannot recover key

(This exception may result if you provided a key password different from the key store password when you generated the self-signed certificate.)

To Regenerate a Key Pair

1. Remove the broker’s key store, located as shown in Appendix A, Platform-Specific Locations of Message Queue^TM Data.

2. Run imqkeytool again to generate a new key pair, as described above.